The 2025 most dangerous software exploits list

 Dad (who was a history professor) liked to say that History repeats itself because nobody listens the first time.  I get an incredible sense of deja vu all over again looking at Mitre's list of top 25 exploits for 2025.

The top 4 are all very, very old.  I myself demonstrated #4 when I taught a computer security class (with corporate IT Security present) back in 1994.  That's three decades ago.

And what's with numbers 11 and 14?  One of the classic papers on software security is Smashing The Stack For Fun And Profit - from 1996.

Numbers 3, 6, and 22 are web server vulnerabilities that are over 20 years old, and I've posted about them before. 

17, 19, and 21 have been known since before I was in this industry.  Call it the 1980s, although it's likely older.

I guess it's nice to see a shout-out to DoS (number 25) although geez, this is depressing.

So that's half the list having been known for literally multiple decades. So what gives?

I blame Agile Software Development.   I guess I'm the cranky old guy yelling at the sky here, because this is how all software is developed these days.  Product Managers (my old field) are to blame here, having spent the last 20 or 30 years pushing Go Ugly Early - get working product shipping as soon as possible and let customers tell you how to improve it.  Essentially, a lot of what you would have the developers spend their time fixing are things that customers just don't care about.

This has led to a pushback of sorts from software professionals, particularly the Software Craftsmanship movement.  Their manifesto is interesting:

As aspiring Software Craftsmen we are raising the bar of professional software development by practicing it and helping others learn the craft. Through this work we have come to value:

• Not only working software, but also well-crafted software
• Not only responding to change, but also steadily adding value
• Not only individuals and interactions, but also a community of professionals
• Not only customer collaboration, but also productive partnerships

So what's missing from this?  How about don't keep making the same dumb security mistakes that people have been making for decades?

And what do Product Managers miss in their rush to go ugly early? How about don't keep making the same dumb security mistakes that people have been making for decades?

And so here we are.  The IT infrastructure of the 21st Century has been constructed out of moonbeams and cotton candy.

I don't see anything changing here, as the incentive structures are all stacked against good security. 

I would have throught that German IT Security teams would be more competent than this

I was not expecting this:

Germany's infosec office (BSI) is sounding the alarm after finding that 92 percent of the nation's Exchange boxes are still running out-of-support software, a fortnight after Microsoft axed versions 2016 and 2019.

While the end of Windows 10 updates occupied most of the headlines, Microsoft's support for Exchange and a bunch of other 2016 and 2019-branded products ended on October 14, as scheduled a year earlier.

Alternate title: 90% of German firms fail their SOC 2 audit.  Look, this isn't landing a man on the moon, and you had a whole year.  You just couldn't be bothered.

Was ist los? 

 

Security: not advancing at the speed of a freight train

Well, the security of the freight train, that is:

When independent security researcher Neil Smith reported a vulnerability in a comms standard used by trains to the US government in 2012, he most likely didn't expect it would take until 2025 to sort the matter out, but here we are.

The US Cybersecurity and Infrastructure Security Agency (CISA) issued CVE-2025-1727 (CVSS v3.1 8.1) last week, specifying the issue as one of weak authentication in the end-of-train to head-of-train linking protocol - allowing an attacker to input their own braking commands and stop the train in its tracks.

Now that's pretty bad, just by itself.  This could also cause derailment.  But this part is maddening:

With a simple exploit sitting out there in the open since 2012 (if Smith discovered it, someone else might too), it seems practically negligent that someone didn't take action, but as a 2016 story from the Boston Review explains, it's not a surprise.

The article tells the story of Smith's by then four-year tussle with the AAR upon first reporting the matter to the US Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) after successfully recording telemetry data from a passing train using an SDR in 2012.

ICS-CERT went to AAR with Smith's concerns, hoping they would be open to further security testing, but that initial contact was as far as it went - and as far as the BR story was able to glimpse into the struggle.

As Smith explained on X, the Boston Review article led to some burnout on the matter until security researcher Eric Reuter gave a talk at DEFCON in 2018, presenting an independent discovery of the same issue. By 2024, ICS-CERT had restructured several times, and Smith decided to reach back out to see if they could reopen the issue.

According to Smith, AAR's infosec director saw it as a minor issue since the FRED protocol was end-of-life and slated for replacement, despite still being in use.

Translation: yeah, we sat on this for 12 years but it's all good, bro. 

All those people going on about "OMG Trump is going to gut Internet Security teams" should ask themselves just what the heck those teams have been up to for the last dozen years.

40,000 Internet-connected cameras have no security

This is my shocked face.  I mean who would have seen that coming?

But the cameras are insecure by default, which means that they are insecure forever:

Security researchers managed to access the live feeds of 40,000 internet-connected cameras worldwide and they may have only scratched the surface of what's possible....

Aside from the potential national security implications, cameras were also accessed in hotels, gyms, construction sites, retail premises, and residential areas, which the researchers said could prove useful for petty criminals.

...

"It should be obvious to everyone that leaving a camera exposed on the internet is a bad idea, and yet thousands of them are still accessible," said Bitsight in a report.

Gee, ya think? 

There are two problems, both related:

1. Profit margins on consumer goods are razor thin.  Money spent on secure-by-default designs cost money.
2. Most consumer electronics are manufactured in China.  The Red Chinese* government doesn't encourage better security for devices intended to be shipped to the USA.

So if you get any of these God forsaken things, look online on how to secure them before you install them.  You can get most manuals in PDF - although I expect a lot of them won't go deep into the issue.  For example, I can't find a single Youtube video on how to set up a Ring doorbell securely.

Also expect to may more for devices with better security, assuming you can find any. 

There's some good ideas on IoT security here. I have posted in the past about having a separate WiFi network that is firewalled off from your home WiFi.

This. 1000x this.

When did the EU.gov get so, well, stupid?

The EU has issued its plans to keep the continent's denizens secure and among the pages of bureaucratese are a few worrying sections that indicate the political union wants to backdoor encryption by 2026, or even sooner.

While the superstate has made noises about backdooring encryption before the ProtectEU plan [PDF], launched on Monday at the European Parliament, says the European Commission wants to develop a roadmap to allow "lawful and effective access to data for law enforcement in 2025" and a technology roadmap to do so by the following year.

...

According to the document, the EC will set up a Security Research & Innovation Campus at its Joint Research Centre in 2026 to work out the technical details. Since it's impossible to backdoor encryption in a way that can't be exploited by others, it seems a very odd move to make if security's your goal.

China, Russia, and the US certainly would spend a huge amount of time and money to find the backdoor. Even American law enforcement has given up on the cause of backdooring, although the UK still seems to be wedded to the idea. [boldface by me - Borepatch]

Well, duh.

Now the cynical view of things is that the EU.gov is not being stupid at all, but just think that their adversary is not China and Russia and the USofA but rather their own populations.  

 

Security wasn't an afterthought, it wasn't thought of at all

This keeps coming up over and over.  The latest example is GoDaddy:

GoDaddy has failed to protect its web-hosting platform with even basic infosec tools and practices since 2018, according to the FTC, but the internet giant won’t face any immediate consequences for its many alleged acts of omission.

As one of the world's largest web-hosting companies, and a registry and registrar with about 82 million domain names in its care, one would assume GoDaddy would be adept at applying software updates and monitoring security-related events in its hosting environment to protect its millions of customers and the visitors to their websites from online threats.

But according to a Wednesday statement from the FTC, “GoDaddy has failed to implement reasonable and appropriate security measures to protect and monitor its website-hosting environments for security threats, and misled customers about the extent of its data security protections on its website hosting services.”

So what triple-propellorhead security tech did they miss?  Basics like security log analysis tools, multi-factor authentication on login, missing security patches, and not maintaining an inventory of their systems.  This is all Security 101.  Actually, it may be Security Pre-K.

If you use GoDaddy's hosting you might want to consider an alternative.

 

Someone at Netflix is getting fired

So their live streaming of the Mike Tyson fight last night was an unmitigated disaster.  But come on - you'd think that Netflix IT would understand how to spin up capacity to meet demand.  Maybe their replacements will.

For those who like the Sweet Science (or who used to), this is a fascinating episode from Hard Core History about how boxing has changed over time, mostly for the worse.  Dan Carlin interviews Mike Silver, author of The Arc of Boxing which is a terrific read.  I'm in general agreement with both the podcast and the book, although have to admit that I quite enjoyed the Barrios/Ramos bout last night.  It had a very Friday Night Fights feel to it.

Quote of the Day

It's been oddly quiet after the election - no cities burning, that sort of thing.  And this is interesting:

Only anecdotal but my girlfriend says her lefty keyboard warrior friends have been oddly silent on Facebook since Tuesday. This is the way.

Very oddly quiet for a bunch of folks who wouldn't shut up about how Trump was a fascist and democracy would be dead if he won.   Very oddly quiet.

Meta fined for storing user passwords with no encryption

Holy cow, I've been in this industry for decades and can't remember a time when everyone knew that you encrypted the damn passwords*:

Officials in Ireland have fined Meta $101 million for storing hundreds of millions of user passwords in plaintext and making them broadly available to company employees.

Meta disclosed the lapse in early 2019. The company said that apps for connecting to various Meta-owned social networks had logged user passwords in plaintext and stored them in a database that had been searched by roughly 2,000 company engineers, who collectively queried the stash more than 9 million times.

This is such a rookie mistake that it makes you wonder what those 9 million queries were looking for.  Meta has such a horrible reputation for abusing its users privacy that the suspicion is that this was just one more wring on that rag.  That's only a suspicion, but Meta has certainly earned that suspicion over the years.

* Yeah, yeah I know - one-way hash.  I try not to use too much tech jargon.

Well, that's one way to improve the Internet coverage on a Navy ship

Navy finds hidden Starlink dish on ship:

Still, the ambassador had nothing on senior enlisted crew members of the littoral combat ship USS Manchester, who didn't like the Navy's restriction of onboard Internet access. In 2023, they decided that the best way to deal with the problem was to secretly bolt a Starlink terminal to the "O-5 level weatherdeck" of a US warship.

They called the resulting Wi-Fi network "STINKY"—and when officers on the ship heard rumors and began asking questions, the leader of the scheme brazenly lied about it. Then, when exposed, she went so far as to make up fake Starlink usage reports suggesting that the system had only been accessed while in port, where cybersecurity and espionage concerns were lower.

Well, it is a pain in the rear end to get hooked up to SIPRnet ... 

Of course, there's been a general helping of Courts Martials to everyone involved.

And the funniest bit?  Elon Musk had Starlink change the default WiFi SSID to "Stinky" to encourage customers to change the damn defaults.

What is this, 1990?

SolarWinds issues security patch to eliminate hard coded password:

SolarWinds left hardcoded credentials in its Web Help Desk product that can be used by remote, unauthenticated attackers to log into vulnerable instances, access internal functionality, and modify sensitive data

The software maker has now issued an update to address that critical oversight; its users are encouraged to install the fix, which presumably removes the baked-in creds.

[blink] [blink]

What makes this even more double-plus ungood is that SolarWinds is a security company.  They know that hard coded passwords are not just A Very Bad Thing Indeed, but considered harmful*.

I guess the only other possibility is that they don't know this, but I just don't believe that.  Heads should roll over this.

* Old computing graybeards will remember the ACM paper "GoTo Considered Harmful" which created such a furor that "considered harmful" is now considered harmful when used descriptively.

Except here, where it is 100% justified.

FBI security measures laughably weak

The FBI Inspector General has issued a scathing report about the Bureau's lackadaisical  attitude towards protecting sensitive data:

The FBI has made serious slip-ups in how it processes and destroys electronic storage media seized as part of investigations, according to an audit by the Department of Justice Office of the Inspector General.

Drives containing national security data, Foreign Intelligence Surveillance Act information and documents classified as Secret were routinely unlabeled, opening the potential for it to be either lost or stolen, the report [PDF] addressed to FBI Director Christopher Wray states.

...

The OIG report notes that it found boxes of hard drives and removable storage sitting open and unattended for "days or even weeks" because they were only sealed once the boxes were full. This potentially allows any of the 395 staff and contractors with access to the facility to have a rummage around.

There is a photo of the storage facility at the link, and it can only be described as horrifying.

I guess they are too busy spying on regime enemies to, you know, take security very seriously.

Well, that doesn't sound like much of a "Cybersecurity Lab"

Cybersecurity Lab didn't use antivirus:

Dr. Emmanouil "Manos" Antonakakis runs a Georgia Tech cybersecurity lab and has attracted millions of dollars in the last few years from the US government for Department of Defense research projects like "Rhamnousia: Attributing Cyber Actors Through Tensor Decomposition and Novel Data Acquisition."

The government yesterday sued Georgia Tech in federal court, singling out Antonakakis and claiming that neither he nor Georgia Tech followed basic (and required) security protocols for years, knew they were not in compliance with such protocols, and then submitted invoices for their DoD projects anyway.

It seems that Dr. Antonakakis wasn't much impressed with antivirus products.  Fair enough - it's a perpetual game of locking the barn door after the horse got out.

But the contract said that the lab would follow particular standards (in this case, NIST 800-171) which mandates antivirus, and the lab issued compliance statements with the invoices they submitted.  This case seems pretty cut and dried.

And not at all impressive for Georgia Tech Cybersecurity Lab.

 

The Democratic Party loses the signal

Electronic communications rely on the concept of a Carrier Wave.  Basically, this is a well-defined electronic signal that all devices can "tune" into, and upon which the actual message is transmitted.  If you lose the carrier, you lose your connection and you can't communicate with anybody.

You Old Farts will remember the old dial-up modem days.  You see, most houses back in the paleolithic age (say, the 1990s) only had one phone line.  Hen Junior wanted to jump on Compuserve (or, Lord forbid, America Online), his biggest worry was often that Mom would pick up the phone to call a friend.  When the phone went off-hook, the carrier signal went all skew-wumpus* and the modem connection dropped.  There was even a long running BBS joke Hey! Wait! Don't pick up the ph{#`%${%&`+'${`%&NO CARRIER

Good times, good times.

Well, the Democratic Party has had control of the carrier wave to the American people for a long, long time.  The first post I tagged Biased Media was way back in 2008, and it was obvious even back then.  They've been used to jamming the Republicans access to the Carrier for a long time.  This has given the Democrat's a big advantage for a long, long time.

That's been going away for a long, long time.  Reagan beat Carter, and then whats-his-name from Minnesota.  The Republicans swept control of Congress in the 1990s.  The whole "Bush lied" (about Iraq) dates back to Hillary Clinton who needed Media air cover for her vote to authorize the Iraq invasion in 2003.  Sure, Obama won in 2008 but the 2010 elections decimated the Democratic Party, as the country reacted in revulsion to the far left-wing policies of his administration.

In my counting, that's 40 years of increasing rejection of the Democratic Party's narrative pushed by an increasingly weak and irrelevant media.

And so here we are at today.  We've had two mass shootings in as many weeks, and three or four in the last couple of months.  It's so perfectly set up to support the Democratic narrative that people are wondering if this is yet more FBI instigation**.  And yet, it's not moving the needle in the Democrat's favor.  Consider:

• Senate Majority Leader (Democrat) Chuck Schumer has refused to move forward with a gun control bill.  This is despite all the recent mass shootings.  Schumer may be a jerk but he knows how to count votes, and he knows how to look at what the polls say about issues.  The American people are entirely uninterested in more gun control, and forcing his party to put their necks on that chopping block is something that he (wisely) will not do.
• Covid is over, and every time a (Democrat) politician or bureaucrat suggests further lock downs or restrictions this "news" disappears from the media in a day.  It's political suicide, any why the Democrats would love to ride that crisis further, they know they'd just ride it into the ditch.
• Russia! Russia! Russia! is over.  Polls are starting to show that people want sanctions to end so we can import oil from them to drop gas prices.  The joke is I can't believe that it's MonkeyPox season!  I still have my Ukraine decorations up!
  

• Oh, yeah - I forgot all about the riots.  And MonkeyPox?  Bitch, please.

Each of these has had a shelf life measured between 2 months and 2 days, but the lifetime is shortening.  And as this has played out, Joe Biden's approval ratings have continued sinking.  He's now the least popular "President" since Harry Truman.  That's 70 years.  If you actually remember Harry Truman, you're really, really old.  Polls repeatedly show that people would prefer Republican candidates over Democrat ones by 5, or 8, or 10 points.

My point is that the media and the Democrat Party (but I repeat myself) is that crisis after crisis after crisis, all blamed on the Republicans, or Vladimir Putin, or White People have had precisely zero effect.  Nada. Nichto.  ничто.  无.

So to my point - The Democrats are very unpopular, and are getting increasingly unpopular.  The Media has lost all ability to change this trajectory.  We will leave for another day the question of whether the Republicans will be any better, but in all honesty - could they possibly be worse?***

We will also leave for another day the question of how legitimacy is established in a "Western Democracy" when elections are repeatedly stolen.  There's no question that both the Democratic and Republican Parties are up to this, and since "free and fair elections" are the bedrock of the American sense of political legitimacy, what happens when this is under minded needs to be explored in more detail.****

I shall endeavor to address these open items this weekend.  But I maintain what I said ten years ago after another notorious mass shooting: no new gun control laws are on offer.  And if Republican s are smart, after the Supreme Court strikes down Roe v. Wade they should counter all gun control proposals with "Common Sense" abortion control proposals.  You'd have to pop popcorn to enjoy the meltdown that would induce.

* Technical term in computer networking, I was told.

** Remember the jury that refused to convict the people who were "plotting to kidnap" the Michigan Governor because almost all of the folks who were involved were FBI? 

*** Spoiler alert: maybe.

**** Spoiler alert: nothing good.

About "Ghost Guns"

I'm struggling to understand what the Administration is trying to accomplish (other than a Press Conference).  If they ban 80% lowers, people will just 3D print them.  Heck, I've been posting about this for almost a decade, and the technology is way more advanced now.  What are they going to do, criminalize 3D printers?

It seems that it's all a tale told by and for idiots, full of sound and fury but ultimately signifying nothing. 

Why Joe Biden is in trouble

John Michael Greer looks at the bumbling and incoherence seen from the current Administrations and ponders how they can be so incompetent.  It's the Soviet Union all over again, where ideology is everything and results nothing:

The more tightly you focus your educational system on a set of approved abstractions, and the more inflexibly you assume that your ideology is more accurate than the facts, the more certain you can be that you will slam headfirst into one self-inflicted failure after another. The Soviet managerial aristocracy never grasped that, and so the burden of dealing with the gap between rhetoric and reality fell entirely on the rest of the population. That was why, when the final crisis came, the descendants of the people who stormed the Winter Palace in 1917, and rallied around the newborn Soviet state in the bitter civil war that followed, simply shrugged and let the whole thing come crashing down.

We’re arguably not far from similar scenes here in the United States, for the same reasons: the gap between rhetoric and reality gapes just as wide in Biden’s America as it did in Chernenko’s Soviet Union. When a ruling class puts more stress on using the right abstractions than on getting the right results, those who have to put up with the failures—i.e., the rest of us—withdraw their loyalty and their labor from the system, and sooner or later, down it comes.

We've seen this play out before.

On the Internet nobody can tell if you're a dog

Politeness is a sign of dignity, not of subservience.

- Theodore Roosevelt 

But everybody can tell if you're an asshole.

Divemedic posted his stance on the vaccine: get it if you think it's right for you, don't get it if you don't think it's right for you.  A more sensible position is hard to imagine.

And then The Internet appeared in his comments section, with SumD00d telling him he was wrong (well, I think that's what he said because the comment was fairly incomprehensible; hey, it's The Internet, amirite?).

And while the comment was moderately incoherent, the attitude of the commenter was anything but.  Commenter "Hedge" is an asshole.  He may (or may not) be a dog with a keyboard but he is unmistakably an asshole with one.

Sigh.

I am very grateful indeed that the commenters here are almost always respectful and intelligent - and the commenters on the Dad Jokes are funny as hell.  I almost never need to step in to tell folks to settle down and mind their manners - maybe only 2 or 3 times in the 13 years I've been here.

People think wrong when they think that the Internet gives them anonymity.  It doesn't.  It gives pseudonymity, which is not at all the same thing.  If you post under a pseudonym (like Hedge and I both do), you still develop a reputation.  Quite frankly, you can't comment anonymously here, so anything you say in the comments here will add to (or in rare cases detract from) your reputation.

Divemedic certainly doesn't need me to fight his fights, that's not the point of this post.  I love  comments and the two way (or multiple way) discussions we have here.  But I'm not going to tolerate Internet Assholes like Hedge here.  Cathedra mea, regula meae - my place, my rules..  If you don't like it, don't stop by.  This really isn't very hard.

It is a wise thing to be polite; consequently, it is a stupid thing to be rude. To make enemies by unnecessary and willful incivility, is just as insane a proceeding as to set your house on fire. For politeness is like a counter--an avowedly false coin, with which it is foolish to be stingy. 

- Arthur Schopenhauer, The Wisdom Of Life 

Electronic door locks remotely hackable

It's a truism in the software development industry that if architects designed buildings the way programmers wrote code, the first woodpecker that came along would destroy civilization.  Today's example is the U-Tec UltraLoq door lock, sold at many fine retailers including Wally World and the Big Orange Box store.  If costs you $139.99, and you can unlock your front door with an app on your phone.

And here's where the fly dives into the ointment.  The cloud service your app talks to had a bunch of vulnerabilities that allowed any Tom, Dick, and Harry to anonymously get access to the device and user database.  It let researchers unlock the door:

The MQTT data correlates email addresses, local MAC addresses, and public IP addresses suitable for geolocation. This is enough detail to precisely identify an individual. The device is also broadcasting the MAC address to anyone within radio range.

This means that an anonymous attacker would also be able to collect identifying details of any active U-Tec customers including their email address, IP address, and wireless MAC addresses.

• This is enough to identify a specific person along with their household address.
• If the person ever unlocks their door with the U-Tec app, the attacker will also now have a token to unlock the door at a time of their choosing.

Emphasis in the original.

Oh, for added coolness, the Shodan search tool will identify all of these, worldwide.

The vendor has fixed the cloud service so this can't be exploited, but my original point remains - any woodpecker that stumbles by could have opened your front door.  We only know about this because the White Hat guys at Tripwire took a look.  Who else has a product like this where nobody has taken a look?

Now think about the "peaceful protesters" coming into neighborhoods to "peacefully protest" outside people's homes.  These "peaceful protesters" have a bunch of mal-adjusted sociopaths who look to me like some of the Black Hat guys we've seen in the past.  What are the chances that some Antifa d00d can get a lot of status on the Island of Misfit Toys by figuring out what people could be targeted for a living room serenade?

Leo the Great and Attila the Hun

The Roman Empire was falling.  The Fifth Century was a disaster for the Empire, but it didn't help when Attila the Hun invaded Italy in 452.  The Empire's armies were exhausted and beaten, and the path to the Eternal City itself lay open.  With nobody to defend the people, Pope Leo rode out to meet the (in)famous barbarian.

Fresco by Raffael showing the meeting of Leo and Attila

Leo faced Attila and his Huns.  All we know for sure is that it was Attila that blinked; the Huns withdrew beyond the Danube river, leaving Rome untouched.  Not for nothing is Leo called "The Great" - the first Pope receiving that much-desired adjective.

But that was then, and this is now.  St. John's Episcopal Church sits on Lafayette Square in Washington D.C., across from the White House.  Rioters tried to burn it down, and Donald Trump took an unexpected walk across the square to stand up for civilization.  You'd think that people trying to burn down historic churches would be, well, barbarians.  If you listened to the Bishop from that church, you'd think you were wrong:

She told Anderson Cooper of CNN, "I am outraged. The president did not pray when he came to St John’s nor, as you just articulated, did he acknowledge the agony of our country right now — in particular, that of the people of color in our nation who wonder is anyone in public power will ever acknowledge their sacred worth and who are rightfully demanding an end to 400 years of systemic racism and white supremacy in our country … We distance ourselves from the incendiary language of this President."

 

The bishop sided with the barbarians. I suppose turncoat bishops have done that over the centuries.

Mariann Edgar Budde is no Pope Leo the Great.  The barbarians are trying to sack our Eternal City and the Church is telling us that we're on our own.

I'm not going to fly on a Boeing 737 MAX

It seems that it was "designed by clowns":

The release of a batch of internal messages has raised more questions about the safety of Boeing's 737 Max.

In one of the communications, an employee said the plane was "designed by clowns".

Apparently Boeing is all butt-hurt about the content of the documents but disclosed them in the interests of transparency.  I guess that's a good thing, but this is really bad for the company:

One unnamed employee wrote in an exchange of instant messages in April 2017: "This airplane is designed by clowns who in turn are supervised by monkeys."

And this is really, really, really bad for the company:

In February 2018, a Boeing worker asked a colleague: "Would you put your family on a Max simulator-trained aircraft? I wouldn't."

"No," came the reply.

Woah.  Boeing employees who built the aircraft won't let their families fly on it.

I don't know if the MAX needs to be a write-off, but I really can't see how you get people flying on this, other than by tricking them.  At least, those who pay attention.

Prediction: the first airline that puts them into service and then suffers a crash will be sued out of business, and these documents will be prominent in the legal actions.

And this has the ring of God's Own Truth to it:

"I don't know how to fix these things... it's systemic. It's culture. It's the fact we have a senior leadership team that understand very little about the business and yet are driving us to certain objectives," said an employee in an email dated June 2018.

I wonder if criminal indictments are in the leadership team's future?